code-foundry 1.7.0 → 1.8.0

package/.gitignore

@@ -39,6 +39,8 @@ htmlcov/
 .coverage*
 .next/
 artifacts/
+performance-results.json
+performance-results/
 cache/
 !.github/actions/cache/
 !.github/actions/cache/action.yml

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.8.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.7.0...v1.8.0) (2026-09-08)
+
+
+### Features
+
+* **performance:** enforce source budgets ([#499](https://github.com/0xPlayerOne/code-foundry/issues/499)) ([2f65ba1](https://github.com/0xPlayerOne/code-foundry/commit/2f65ba127f8fe186eda5d6bcae77150f13458428))
+
 ## [1.7.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.6.1...v1.7.0) (2026-09-08)
 
 

package/docs/PERFORMANCE.md

@@ -0,0 +1,58 @@
+# Performance budgets and baselines
+
+Code Foundry measures its source runtime with `bun run performance:check`. The
+check writes `performance-results.json` for CI artifact upload and fails when a
+budget is exceeded. Generated reports are ignored by Git because measurements
+belong to the run that produced them, not the source tree.
+
+## Enforced budgets
+
+| Metric                              | Budget | Why it is bounded                                    |
+| ----------------------------------- | -----: | ---------------------------------------------------- |
+| CLI help startup p95                | 250 ms | Detect eager imports and startup regressions         |
+| Runtime mode startup p95            | 250 ms | Detect baseline runtime initialization regressions   |
+| Focused runtime tests               |   10 s | Keep the representative runtime contract inexpensive |
+| Format, lint, type-check, and build |   15 s | Bound the local CI feedback loop                     |
+| Runtime dependencies                |      0 | Keep the installed CLI dependency-free               |
+| Development dependencies            |      4 | Prevent unreviewed toolchain growth                  |
+| Packed artifact                     | 200 kB | Bound registry transfer and install cost             |
+| Unpacked artifact                   | 750 kB | Bound installed footprint                            |
+| Packed files                        |     80 | Detect accidental release contents                   |
+
+The performance workflow disables build-cache reads and writes for this task.
+That makes timing comparisons independent of a warm protected-branch cache and
+prevents benchmark code from populating shared cache entries.
+
+## v1.6.1 baseline
+
+Measurements were taken on 2026-09-08 with Node 24.18.0. Process startup used
+30 measured samples after four warmups; before and after samples were
+interleaved on the same host.
+
+| Measurement                |   Before |                   After |   Change |
+| -------------------------- | -------: | ----------------------: | -------: |
+| CLI help median            | 36.11 ms |                29.57 ms |   -18.1% |
+| CLI help p95               | 38.11 ms |                31.56 ms |   -17.2% |
+| Runtime mode median        |        - |                35.94 ms | baseline |
+| Focused runtime tests      |        - |                  2.08 s | baseline |
+| Local CI checks            |        - |                  0.50 s | baseline |
+| Packed / unpacked artifact |        - | 160,114 / 616,887 bytes | baseline |
+| Packed files               |        - |                      74 | baseline |
+
+The startup reduction comes from loading command implementations only after
+argument parsing selects a command. `--help` no longer imports sync, release,
+fleet, doctor, and CI command modules.
+
+The first isolated full hosted audit completed in 3 minutes 2 seconds. Its
+longest jobs were TypeScript CodeQL (66 s), dependency audit (62 s), and unit
+tests (46 s); all other suite jobs completed in 20 seconds or less. Those
+measurements identify the three lanes to optimize before adding more CI fanout.
+
+## Release path
+
+Treat budget changes like source changes: explain the measured reason in a
+pull request, run the complete validation gate, and merge only when the new
+result artifact is available. A Release Please PR then carries the change into
+the next version. Never raise a budget solely to clear CI; include before/after
+measurements and the expected effect on local feedback, hosted runner time,
+package transfer, or installed footprint.

package/docs/README.md

@@ -12,6 +12,7 @@ its own names, environments, and deployment details.
 - [Release management](RELEASES.md)
 - [Publishing packages](PUBLISHING.md)
 - [Caching and remote caching](CACHING.md)
+- [Performance budgets and baselines](PERFORMANCE.md)
 
 ## Repository-specific documentation
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {
@@ -43,6 +43,7 @@
     "format:check": "oxfmt --check .",
     "fmt": "oxfmt .",
     "lint": "oxlint",
+    "performance:check": "node scripts/performance-check.mjs",
     "test": "node --test",
     "test:unit": "node --test",
     "type-check": "tsc --project jsconfig.json",

package/src/cli.mjs

@@ -4,16 +4,6 @@
 import { resolve } from 'node:path'
 import { readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
-import { doctor } from './commands/doctor.mjs'
-import {
-  dispatchPostReleaseHook,
-  reconcileRelease,
-  releaseRecoveryPlan,
-  validateReleasePullRequestDiffs,
-} from './commands/release.mjs'
-import { discoverRepositories, upgradeFleet } from './commands/fleet.mjs'
-import { syncRepository } from './commands/sync.mjs'
-import { manageCiBilling } from './commands/ci.mjs'
 
 const packageRoot = resolve(fileURLToPath(new URL('..', import.meta.url)))
 
@@ -133,12 +123,13 @@ function parseArgs(argv) {
   return { command, options }
 }
 
-function main() {
+async function main() {
   const { command, options } = parseArgs(process.argv.slice(2))
   const target = resolve(options.target)
 
   if (command === 'init') {
     try {
+      const { syncRepository } = await import('./commands/sync.mjs')
       syncRepository({
         target,
         source: packageRoot,
@@ -151,12 +142,14 @@ function main() {
     }
   } else if (command === 'sync') {
     try {
+      const { syncRepository } = await import('./commands/sync.mjs')
       syncRepository({ target, source: packageRoot, dryRun: options.dryRun, force: options.force })
     } catch (error) {
       fail(error instanceof Error ? error.message : String(error))
     }
   } else if (command === 'doctor') {
     try {
+      const { doctor } = await import('./commands/doctor.mjs')
       doctor(target, { github: options.github })
     } catch (error) {
       console.error(`code-foundry: ${error instanceof Error ? error.message : String(error)}`)
@@ -164,6 +157,12 @@ function main() {
     }
   } else if (command === 'release') {
     try {
+      const {
+        dispatchPostReleaseHook,
+        reconcileRelease,
+        releaseRecoveryPlan,
+        validateReleasePullRequestDiffs,
+      } = await import('./commands/release.mjs')
       if (options.releaseSubcommand === 'hook') dispatchPostReleaseHook(target, options)
       else if (options.releaseSubcommand === 'validate-prs') validateReleasePullRequestDiffs(target)
       else if (options.releaseSubcommand === 'recovery-plan') releaseRecoveryPlan(target)
@@ -173,6 +172,7 @@ function main() {
     }
   } else if (command === 'fleet') {
     try {
+      const { discoverRepositories, upgradeFleet } = await import('./commands/fleet.mjs')
       const root = resolve(options.root)
       if (options.fleetSubcommand === 'status')
         console.log(JSON.stringify(discoverRepositories(root), null, 2))
@@ -189,6 +189,7 @@ function main() {
     }
   } else if (command === 'ci') {
     try {
+      const { manageCiBilling } = await import('./commands/ci.mjs')
       manageCiBilling(target, /** @type {'pause'|'resume'|'status'} */ (options.ciSubcommand))
     } catch (error) {
       fail(error instanceof Error ? error.message : String(error))
@@ -196,7 +197,7 @@ function main() {
   } else fail(`unknown command: ${command}`)
 }
 
-main()
+await main()
 
 /** @param {string} root @returns {string} */
 function readPackageVersion(root) {

package/src/templates/gitignore

@@ -39,6 +39,8 @@ htmlcov/
 .coverage*
 .next/
 artifacts/
+performance-results.json
+performance-results/
 cache/
 !.github/actions/cache/
 !.github/actions/cache/action.yml